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By using local quantum teleportation of a fixed state to one qubit of an entangled pair sent from the 
other party, it is shown how one party can commit a bit with only classical information as evidence 
that results in an unconditionally secure protocol. The well-known "impossibility proof" does not 
cover such protocols due to its different commitment and opening prescriptions, which necessitate 
actual quantum measurements among different possible systems that cannot be entangled as a 
consequence. 



It is nearly universally accepted that unconditionally 
secure quantum bit commitment is impossible due to en- 
tanglement cheating. For a brief summary of the prob- 
lem and further references to the literature, see Ref. 0. 
In this paper, a concise self-contained description of a 
protocol belonging to what we call Type 5 QBC proto- 
cols, is presented together with a security proof. Such 
protocols are based on two-way quantum and classical 
communications within the framework of ordinary quan- 
tum mechanics, without the use of additional constraints 
such as relativity or super-selection rules, and in which 
only classical information is committed as evidence. The 
preliminary protocol QBC5p is a two-stage protocol in 
which Babe sends Adam many maximally entangled pairs 
of qubits Ha ® Hn, £ € {1, . . . , n}, on each of which a 
unitary transformation Uik unknown to Adam has been 
applied to Ha . Adam picks one pair Ha ® H& and tele- 
ports to Ha one °f two known orthogonal states in H$ 
corresponding to the bit value b = or 1, and commits 
the Bell-basis measurement result on H( 2 ® H( 3 to Babe. 
He opens by sending Ha and the remaining n — 1 qubit 
pairs to Babe, who verifies by making the corresponding 
projection measurements. This protocol is e-concealing 
and can be extended to an e-binding one, QBC5, in a se- 
quence. The reasons underlying the success of this pro- 
tocol will be explained in this paper. But the drastic 
difference between this protocol and the ones covered by 
the "impossibility proof" (IP) should be evident. Aside 
from details, the main step of QBC5 outlined above is 
quite simple, as is the idea behind it which is the reverse 
of the usual formulation: measurement result committed 
and quantum state given at opening instead of state com- 
mitted and measurement result given at opening. The 
teleportation prevents Adam from entangling the open- 
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ing possibilities. 

Consider first the case of a single qubit pair. Starting 
from a fixed openly known, say, 'f^ = -^=(| O2 — 
I l)i\ 1)2), Babe applies a unitary f7& known only to 
herself to Hi, and sends the resulting Hi ® Hi in state 
"ffc = (Uk <B> 1)^12 to Adam. If Adam measures the Bell 
basis 

* ± = ^(|T)U)±U)IT)), 
* ± = ^(|T)IT)±U)U)) 

on H2^)Hs for any state \4>) on H3, he would obtain each 
result i € {1, 2, 3, 4}, with probability j corresponding to 
^ r± and $ ± , with resulting state in Hi given by: 

U k Gi\<t>) (1) 

where <Ji are given by crj = — o z ,02 = —<jq = —I ,03 = 
—i<jy, (7 4. = <t x in terms of the Pauli spin operators. Let 
{|0),|1)} be an openly known orthonormal basis of a 
qubit. To commit b = or 1, Adam may use \<j)) = |b) 
on H3 and obtains Uu^i | b) on Hi from Q , announcing i 
to Babe as the committed evidence. He opens by claim- 
ing b and sending Hi to Babe, who verifies by measuring 
the one-dimensional projection of the state [/fecr, |b). It 
is evident that the protocol is perfectly concealing if she 
does not entangle the possible Uk- with orthogonal states 
|z) representing the classical information committed by 
Adam, Pq = pf = Thus, her conditional probabil- 

ities for optimally estimating the bit b on the basis of the 
committed evidence i are p(b|i) = \ for both b = 0,1. 

For the corresponding binding proof of the situation in 
which Adam opens one bit value perfectly, say opening 
b = with probability 1, we will first show that Adam 

cannot cheat perfectly, i.e., his optimal cheating proba- 
ji 

bility P c of opening b = 1 instead is bounded away from 
1 . This can be seen by exhausting all of his possible ac- 
tions. First note that there is no entanglement possibility 
for him either over the single state | b) , or over the classi- 
cal information i even if it is represented by as only a 
specific i is accepted as legitimate. In order to cheat per- 
fectly, Adam has several courses of action left. The first 
one is for him to teleport |0) to Uk<Ji\Q) and then apply 
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some V A to try changing it to Ui-o~i\l). Another is for 
him to announce some i without a Bell measurement and 
perform the teleportation on some \4>) &H3 with result j 
when he opens b, applying some V A to Hi to obtain the 
proper opening state. The third is just sending some \<j>) 
back to Babe and try to open correctly. Finally, he may 
try to determine Uk- In the first case, his probability of 
successful cheating is given by, for a given i, 

p c A (i) = J2 x ^M vAu ^\ Q )\ 2 ( 2 ) 

A,- 

where Xk is probability that Uk was employed by Babe. 
To obtain P A = 1, one would need each of the terms 
in the sum of HJ) to be one, which is impossible if {Uk} 
is properly chosen, in particular if it is {I , R x , R y , R z } 
where R x is the rotation about the i-axis of the qubit by 
an angle 7r/2 in its Bloch-sphere representation, etc., 

{U k } = {I,R x ,R y ,R z }. (3) 

This is due to the fact that for each Uk, there are only one 
possible rotations V A that makes \(l\a\ulVgU k Oi\Q)\ 2 = 
1 and there is no common rotation that works for all k. In 
the second situation the successful cheating probability 
is, for a given pair and a given b, 

P C A (2) =Y J M{b\°\ulV A UkO ] \4>)\ 2 - (4) 
k 

Again, equation cannot be made equal to 1 with © 
similar to the case of ©. In the third case, 

p A {2,) = Y,M{b\<ylutv A m\ (5) 

k 

which clearly cannot be 1 as T^l^) is independent of k. 
Note that the last two courses of action actually do not 
allow him to open b = perfectly already. Also, other 
{Uk} can be used in lieu of J2J. 

Note the role of the classical evidence i and the role 
of Babe's application of Uk in preventing Adam's per- 
fect cheating. Note also that Adam has no entanglement 
cheating, in contrast to the IP formulation. To summa- 
rize, Adam's optimum cheating probability is some fixed 
A 

number P c = pa < 1 for perfect b=0 opening. The 
exact value of pa depends on the set {Uk} and its proba- 
bility distribution, and can be determined by solving the 
optimization problems corresponding to his possible ac- 
tions described above. But there is no need to determine 
this value for the purpose of proving the possibility of 
obtaining unconditionally secure protocols. 

Babe may entangle over the possible Uk so that she 
keeps H c and sends Hi ® H 2 for |*) e H c <g> Hi <g> H 2 
with \fk) orthonormal in H c , 

1*} = Ev / ^i/fe)(%®/)i*r 2 >. (6) 

In this situation, one can cast the protocol in the IP for- 
mulation for a fixed Bell-measurement result i known to 



both parties by combining and ijBJ), and the proto- 
col is not perfectly concealing. If Adam commits only 
a partial Bell- measurement result, the protocol can still 
be cast in the IP formulation if he only makes the par- 
tial (degenerate) Bell-measurement, and not the full one, 
and then randomizes. To obtain e-concealing, one can 
employ the following strategy — Babe sends Adam an 
ordered sequence of n qubit pairs {Hei <£> Hn}, each en- 
tangled in the form © with Xik = |, \fik) € Hf, and 
{Uik} given by ©■ Adam randomly picks one of these 
pairs, Hfi ® H12, and performs the quantum teleporta- 
tion. Hc commits the result i of the Bell-measurement 
as evidence, but not the name of the pair or Hn itself. 
He opens by sending in Hi x and all the other n — 1 qubit 
pairs. Babe verifies by measuring the projections onto 
Ui k <Ji\b) on Hg X (or the projection onto 10 in Hf ®Hei), 
and (Uik ® I)\^Ji2) 011 the other pairs. 

If Babe entangles pair by pair, it is easily seen that this 
preliminary protocol QBC5p is e-concealing, as Babe has 
probability i of guessing the correct Hf for entangle- 
ment cheating to obtain a cheating probability P C B > |. 
If she does not guess correctly, her cheating probability 
is 5 as shown above. Thus, her optimum Pf < 5 + 577- 
If Babe entangles over all the pairs, a calculation similar 
to that of Section IV in Ref. [3] shows that, conditioned 
on any of Babe's measurement results on her ancilla, the 
same bound on P C B applies. This also follows from the 
fact that pair-by-pair entanglement is entirely general in 
the present case. See also Appendix A of this paper. At 
the same time, Adam cannot cheat perfectly by opera- 
tion on Hfi as above, and he cannot entangle the differ- 
ent possibilities of using any of the n qubit pairs to ob- 
tain i — due to the verification proecedure he could use 
only one qubit pair for teleportation. One cannot entan- 
gle the different possibilities involving measurements and 
no-measurements on different state spaces. A classical 
measurement result is to be obtained, by Babe and thus 
on Adam's qubits too, even if Adam does not perform 
the measurement himself and just sends her a quantum 
state representing the result. The impossibility proof as- 
sumes that all opening possibilities can be purified in an 
entanglement without a proof that it is true in all possi- 
ble situations. The above protocol provides an example 
for which such an assumption is not valid. 

Thus far the "impossibility proof" has already been 
contradicted, since it asserts [J that whenever the proto- 
col is e-concealing, i.e., Babe's optimum cheating prob- 
ability is P c ~ 5, then P c ~ 1 even in the situation 
when he opens b=0 perfectly. If the b=0 perfect open- 
ing condition is relaxed, Adam has more possible actions 
open to him. Exhaustively, they can be described by the 
following and their combinations: approximate cloning 
of using different states than |b) on H3, announc- 
ing a different i from his Bell measurement, opening by 
sending a different qubit from Hi to Babe, and simply 
announcing a different bit value at opening. Two of these 
are already included in the above analysis. By continuity 
of all relevant functions on a finite-dimensional space, it 
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is readily seen that if Adam opens on b=0 with proba- 
bility -Pa(O) = l — then he can cheat no better than 
A 

P c = pa + &2 with lim^^o <$2 = 0. While the optimum 
A 

P c for arbitrary -Pa(O) remains to be determined, there 
is no need to include it here as there does not seem to be 
much interest in protocols where both -Pa(O) and -Pa(I) 
are not close to 1. In any event, the optimum tradeoff 
between -Pa(O) and -Pa(I) may be determined and the av- 
erage probability of opening correctly to Adam's choice 
can be brought down to arbitrarily small level similar to 
the following Pa(Q) — 1 case. 

Protocol QBC5' is obtained when the above QBC5p is 
repeated in a sequence of N such n-pairs, each consist- 
ing of the above protocol step with the same b opening. 
Adam's cheating probability P^ = p 1 ^ can be made arbi- 
trarily small for large N. Babe's entanglement of the Nn 
pairs clearly does not help her cheat as she is left with 
the same small probability of matching the correct Ti.f 
to the announced i. However, her P c s is improved by the 
N repetitions, but it can be made arbitrarily small for 
any fixed N by making n large. The quantitative treat- 
ment of a similar situation has been given in Section VI 
of Ref. Q . The key point is that Adam's optimal cheat- 
ing probability does not keep increasing with N, so that 
arbitrarily large N can be used to reduce P c s to any level 
without corresponding increase in Pf. Thus, the proto- 
col QBC5 is e-concealing and e-binding for any desired 
e > 0. 

So far we have allowed Adam to cheat during both 
commitment and opening but assumed that Babe is hon- 
est in sending Adam the "legal" states. Honesty during 
commitment in a multi-stage protocol is an assumption 
of the "impossibility proof," which has to be relaxed for 
a truly secure protocol. In QBC5, Babe can cheat by, 
e.g., sending |^fc)|^fc), an unentangled state in Hi <8> "Hi, 
so that the Bell measurement probability on |?/>fc)|b) in 
7-L2®H.3 depends on b. This kind of cheating, sending in 
a different state other than one allowed in a multi-stage 
protocol, can be handled in two different ways in general 
that also apply effectively to the "impossibility proof" 
formulation for certain protocols. The first way is to let 
one party send in a large number of the allowed states 
so that the other party can check for honesty on most of 
them and then use the rest. In the present case, Babe 
would send Adam a large number M of pairs, so Adam 
can set aside m <C M of them, and asks Babe for the ex- 
act state in the other M — m pairs. With or without her 
entanglement over such pairs, Babe has to tell exactly 
what each state is, which Adam can verify by a projec- 
tion measurement. With M sufficiently large, it may be 
shown that the probability that any of the m remaining 
states is not a legal one allowed by the protocol, up to 
entanglement by Babe, given all M — m are, can be made 
arbitrarily small for any m. The detailed analysis of this 
approach for the present problem is given in Appendix A 
of this paper. 

What if Babe is found cheating during such testing? 



Clearly, one party can always refuse to cooperate in any 
protocol, which is what repeated cheating and getting 
caught amounts to. It does not alter the fact that the pro- 
tocol allows arbitrarily small cheating probability. One 
meaningful way to deal with repeated cheatings appli- 
cable to realistic environments is to allow a fixed num- 
ber n c of cheating detection, beyond which the cheating 
party is taken to be the loser in an essentially classical 
game-theoretic formulation. The above TV-ensemble can 
be generalized to deal with such a formulation, but it is 
conceptually simpler to have the following explicit game- 
theoretic formulation, our second way to handle the use 
of non-allowed states during commitment. In such a for- 
mulation, there is no TV-ensemble sent simultaneously. 
Only one pair is sent, but the other party has a large 
probability of choosing to check the validity of that state 
instead of going further with the protocol. During the 
successive trials, the other party may decide at any point 
to stop checking and accept the state. It is clear that 
with potentially an unlimited number of trials, the prob- 
ability of successfully sneaking in a nonallowed state can 
be made arbitrarily small for any fixed n c . With n c set 
to be zero, essentially no cheating can be attempted at 
all without undue risk of losing the game. A quantita- 
tive description of this approach is given in Appendix 
B of this paper. Note that neither of these approaches 
is needed if one adopts the IP assumption that Babe is 
honest in submitting only legal states of the protocol to 
Adam. 

With either of these two ways, one can safely be as- 
sured that the parties are honest during the exchanges of 
states or quantum communications in the commitment 
phase of a multi-stage protocol, as was assumed in the 
"impossibility proof" formulation. Under this condition, 
we have completed the concealing and binding proof of 
the following simplification of the above protocol QBC5'. 



To recapitulate the main reason for the security of 
QBC5: one cannot purify the different possibilities of 
measuring different components of a tensor product space 



PROTOCOL QBC5 

(i) Babe sends Adam nN modified singlet pairs 

(Utk ® -0*7i 2 , *7i2 G w « ® I £ 

{1, ...,nN}, named by their positions, with 
each Uik, k £ {1,2,3,4}, randomly drawn from 
{Utk} = {I, Rx, R y , Rz}, the R's being tt/2 rota- 
tions about the qubit axes. 

(ii) Adam teleports the state |b) for the bit b he 
wants to commit to n randomly selected pairs 
among the nN ones, committing to Babe the 
Bell- measurement results i m , m £ {l,...,n} 
without the corresponding names of the pairs. 

(iii) Adam opens by sending {Timi } and all the other 
pairs together with their names to Babe, who ver- 
ifies by corresponding measurements. 
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while leaving the remaining part of the space untouched. 
In QBC5, the tensor product space is <g> 7i.n) 

and the different components are Tin <g> Tin indexed by I. 
Adam cannot entangle the different possible actual mea- 
surements, and if he does not actually measure, he could 
not open b = perfectly corresponding to the committed 
i, which Babe could measure for him anyway in case he 
just sends her the register containing the information i. 

In addition to teleportation, it is shown in Ref. [{| that 
the use of a split entangled pair can yield an uncondition- 
ally secure protocol. A general discussion on the scope 
of the "impossibility proof" is given in Ref. Q together 
with the security proofs of several other protocols. 

APPENDIX A: HONESTY GUARANTEE FROM 
AN ENSEMBLE 

One general approach to guarantee with probability 
arbitrarily close to 1 that a party B is sending a "le- 
gal" state from {ipk} allowed by the protocol, or at least 
sending the entangled superposition 

m = Y, x MB\fk) c (ai) 

for orthonormal \fk)c € Ti , is the following. She sends 
in N states, each randomly drawn independently from 
the given allowed set {ipk} and named, say, by its tem- 
poral position. The other party A randomly picks N — n 
of such states and asks B to reveal them. After verifying 
that they are correct, the probability that all n remaining 
states are at least of the form (JAlf) can be made arbitrar- 
ily close to 1 by proper choice of n, N as follows. 

Suppose B mixes in states ip' that allows her to cheat 
with probability P C B — | > e for a given e. Then the 
cheating detection probability 6 = 1 — \ (ip'\ipk) | 2 > 
minimized over the choice of k and tp' is a fixed number 
dependent only on e and the protocol, independent of n 
and N. Suppose B mixes in m such ip' out of the N 
states she sends to A. We grant that £>'s cheating is 
successful if there is just one copy of ip' in the n-group 
untested by A and the measurements by him reveals no 
different states from {ipk}- In order that there is a non- 
vanishing probability found in the random rt-group that 
A sets aside, m/N must be non- vanishing with m/N — ► p 
in the limit N — ► oo. Let a = n/N so that asymptotically 
for large N, a is the fraction of states among the N set 
aside. In order for B to be able to cheat, one has ma > 1 
for large N because ma is the average number of ip' in 
the n-group. The probability that the cheating detection 
fails in the N — n group is then 

(l-d) m ^-^ < (1-S) 1 ^ ->0, (A2) 

which can be made arbitrarily small by having a arbi- 
trarily small that obtains with N — » oo for fixed n. This 
argument can be completely quantified via the hyper- 
geometric distribution and the Chernov bound without 



passing to the limit N — > oo, although the limiting argu- 
ment suffices for the present purpose. 

In QBC4, a simple modification is needed, in which 
Adam would need Babe to send him Tip together with 
the exact {|/fc)} for checking that the states are indeed 
|* M >|*„) of the form (T}. 

When the number of states {IV'fc)} is equal to or larger 
than the dimension of the state space Ti B sent to Adam, 
an entanglement of the form I|A1(I for each member of the 
ensemble is entirely general. Any other entanglement 
can be obtained by local transformation on Ti c . This 
situation covers all our applications. 

The use of this method suffers from two disadvan- 
tages compared to the next one in Appendix B via game- 
theoretic checking, but has the advantage that no game 
payoffs need to be imposed. The first disadvantage is 
that one needs to make sure that the evaluation of Pa 
from Babe's ensemble takes into account the possibility, 
depending on the IV'/J's, that Adam may be able to de- 
termine it exactly with a nonzero probability. Of course, 
since he usually has to return the unused one for Babe's 
verification, such a strategy may not improve his . In 
our qubit formulation such possibility indeed does not 
arise. 

The second disadvantage is that this approach gives 
Adam an ensemble of choice for each individual \ipk) he 
is going to operate upon, thus the opportunity of entan- 
glement. Thus, one has to deal with such entanglement 
possibility explicitly. This possibility does not exist in 
QBC5, which is indeed the reason why it is secure as 
elaborated in this paper. It does not exist in QBC4 be- 
cause it is perfectly concealing, but it does in our QBC1 
and QBC2 which are dealt with in Ref. 

APPENDIX B: HONESTY GUARANTEE IN A 
GAME-THEORETIC FORMULATION 

During the commitment phase of a multi-stage QBC 
protocol involving exchanges of quantum states, a party 
can try to cheat by using "illegal" states not allowed in 
the protocol. In the "impossibility proof" , this problem 
is not tackled by assuming each party is honest, which is 
an unreasonable assumption in a protocol that precisely 
does not place trust in either party. It turns out, however, 
that a simple classical game formulation can take care of 
this problem, up to entanglement of legal states, in the 
following way. 

Suppose B is giving A a quantum system in possible 
allowable states {ipk}, to be further processed by A. To 
make sure that the state is legal with a probability ar- 
bitrarily close to 1, A can ask B to reveal the state and 
check it by corresponding projection measurement. The 
cheating detection probability is denoted by pd, which 
is determined by the illegal states ip' used by Babe that 
would allow her to cheat beyond e, P c — h > e. After 
checking, the whole protocol would need to be repeated 
up to that point, but there is no question of resource or 
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efficiency in the present context. 

Assuming first that the allowable number of cheats is 
n c = 0, i.e., if B is found cheating the game is over 
and B will be declared the loser. Such a situation oc- 
curs, e.g., when the penalty of being found cheating is 
arbitrarily large. We let A employ a randomized strat- 
egy with a probability p a of accepting _B's state without 
checking, independently from trial to trial without loss 
of generality in this case. Thus _B's strategy can also 
be represented by a probability p c of cheating at each 
trial. In an indefinitely long sequence of trials, B's suc- 
cessful cheating probability Pc can be found as follows. 
The probability B will succeed at the first trial is p c p a , 
at the second is p c p a ({ — Pa — PcPd), and at the nth is 
PcPa(\ — P a—PcPd) 11 ^ 1 - Thus, the total successful cheat- 
ing probability after n trials is 

P c (n) = — ^— [l-(l- PcPa -p cPd )"}. (Bl) 

Pa+Pd 

Similarly, the probability that a legal state is accepted 
after n trials is 

p A (n) = ( f l - p ; ] 

Pa(l - Pc) +PcPd 

x[l - (1 - Pa + PaPc - PcPd ) n ], (B2) 
and the probability a cheating would be detected is 

P D (n)= P f d [l-(l- Pa -PcP d n (B3) 

Pa + PcPd 

Observing that for fixed p d > 0, Pd(^) ^ is equivalent 
to p c — > from (|B3|) . We have 

lim P c {n) = 0, (B4) 

-Pd-o 
n — too 

lim P A (n) = 1. (B5) 

71 — >00 

With a large penalty for cheating, Pd would be driven 
to zero from minimizing the average penalty. Hence p c 
and Pc are also driven to zero, as expected, with Pa — > 
1. Even if no penalty is imposed, Pc(n) may be made 
arbitrarily small for any p c > by making n large and 
Pa/Pd small from IjBljl . while the corresponding Pa(^) 



needs not be close to 1. Since a party has to cooperate 
and accept a protocol if his/her security is guaranteed, as 
formalized by the "Intent Principle" of ref Q on protocol 
agreement, B must pick a small p c to accept a viable 
protocol in this situation. 

With n c > but finite, the same situation as above 
arises after n c — 1 detections of cheating, which would 
occur with probability arbitrarily close to 1 for a long 
enough number n' of trials. It is also possible for A to ter- 
minate the game at any point by accepting the state after 
a fixed number of trials n a . Even though a more compli- 
cated optimal strategy that is trial stage-dependent for 
either party would then emerge, it would go over to the 
above for large n. 

If {ipk} is the set of allowable states, this procedure 
only assures that the state ip € TC B ® TL that B sends 
in is of the form 

\i>) =J2^k) B \fk) c (B6) 

for orthonormal \fk) G H c . Often B cannot cheat al- 
ready in such a case as the Type 5 ones in this paper, 
although in general B may still be able to cheat using 
(|B6|) . In some situations, as in QBC4 of Ref. |5(, one 
party may be asked to entangle as in l|B6|l and later send 
in Tt c for the other party to verify the total entangled 
state. 

In the full unconditionally secure protocol that requir- 
ing a sequence, the above game can be repeated succes- 
sively one by one. The levels of each probability (|B1|) - 
(|B3|) can be adjusted to accommodate the desired level 
on the overall probabilities for the n-sequence. 

The generality of the entanglement (|B6I) for our pro- 
tocols, as well as advantages and disadvantages of this 
game-theoretic approach versus the ensemble approach, 
are briefly discussed in the above Appendix A. 
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